StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

1. Executive summary

Check Point, as reported by The Hacker News, identified a global campaign using nearly 2,000 compromised WordPress sites for ClickFix delivery, malware staging, command-and-control and storage of exfiltrated data. Windows users induced to execute a PowerShell command may receive staged .NET loaders supporting credential theft, document collection, keylogging, screenshots, SMB/USB propagation, WMI lateral movement and optional ransomware deployment. For EMEA financial institutions, the principal risks are credential compromise, sensitive-document theft and propagation through network shares or removable media; actual client exposure is currently unknown. No CVE, CVSS score/severity or CISA KEV state is present in the verified reference data, and “StopAndProtect” has no MITRE ATT&CK profile; attribution is therefore unconfirmed, while all campaign detail remains single-sourced and requires verification before enforcement.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

The reporting does not establish an incident affecting a particular regulated entity, an ICT third-party relationship or an essential service. Clients should perform their normal jurisdiction-specific incident assessment if internal evidence confirms compromise or data loss.

3. Technical analysis & attack chain

The following observed chain is reported by The Hacker News, citing Check Point Research. No independent corroborating source was supplied.

1. WordPress infrastructure compromise: The operators obtained control of nearly 2,000 WordPress sites. Compromise methods are not specified. Some sites reportedly ran outdated WordPress and plugins; one example used a WordPress release from 2021 and was described as susceptible to roughly 40 vulnerabilities.
2. ClickFix delivery: Compromised sites were modified to display fake CAPTCHA prompts. These prompts socially engineered visitors into executing a PowerShell command. The prompt text and command are not available.
3. First-stage download: The PowerShell command deployed a stage-one .NET downloader that reported infection statistics to an operator-controlled server and loaded the next stage.
4. Loader execution: A second .NET downloader/loader performed sandbox checks, generated additional operational logging and launched the main components.
5. Host surveillance and collection: SilentDataCollector enumerated all drives, encrypted the resulting list and exfiltrated it. Operators could upload a command file directing the stealer to collect specific files.
6. Propagation and lateral movement: NetworkShareScanner operated as an SMB/USB worm. A separate VBS spreader copied malware to hard disks and removable media, scanned the network and used WMI for lateral movement.
7. Optional disruptive impact: SilentEncryptor could encrypt all infected computers or only systems matching specified hostnames. LockScreen blocked user input and displayed a ransom message containing a payment QR code. Ransomware was not deployed in most observed infections; covert file discovery and theft were more common.
8. C2 and exfiltration: Compromised WordPress sites hosted malware stages, delivered instructions and stored infection logs, screenshots and stolen material.

Component capabilities

• SilentEncryptor: Selective or estate-wide file encryption based on hostnames.
• NetworkShareScanner: Propagation through SMB-accessible systems and USB media.
• VBS spreader: Fixed/removable-drive propagation, network scanning and WMI-based lateral movement.
• LockScreen: User-input blocking and QR-code payment demand.
• SimpleChatProxy: Custom victim-to-operator chat utility.
• SilentDataCollector: Drive enumeration, encrypted inventory exfiltration and command-file-directed collection.

Newer stealer iterations reportedly add keylogging with valid-email-address detection, WhatsApp data collection from web and desktop clients, network-share mapping/unmapping and screenshots every 30 seconds. For WhatsApp collection, an operator supplies a search keyword; the malware waits for user inactivity, focuses the search box, enters the keyword and opens the selected contact information.

No persistence or privilege-escalation mechanism is described. The reporting identifies SMB and WMI but provides no ports, C2 protocol, malware filenames, hashes, domains, IP addresses, registry keys, scheduled-task names or service names.

The article’s reference to roughly 40 possible WordPress vulnerabilities concerns one example site and does not identify any CVE. Consequently, the supplied verified data provides no CVSS score/severity or CISA KEV exploitation state that can be mapped to this campaign.

“StopAndProtect” is a Check Point tracking label derived from a ransomware-family name. It has no MITRE ATT&CK profile in the verified data, so actor attribution is unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

• Isolate any endpoint where a user followed a CAPTCHA instruction and executed PowerShell. Disconnect network shares and removable media before acquisition to limit SMB, WMI and USB propagation.
• Preserve process, PowerShell, network, file-access and authentication telemetry. Acquire memory and disk images where operationally feasible before rebuilding.
• Temporarily block SMB and WMI traffic from suspected hosts. Identify recently accessed removable media and quarantine connected systems pending examination.
• Take confirmed tampered WordPress sites out of service. Preserve the webroot, database, access logs and administrative-authentication records before removing injected CAPTCHA content.
• Disable compromised WordPress or hosting accounts, invalidate active sessions and rotate administrative, hosting and database credentials from a clean system.
• Treat credentials entered after suspected infection as exposed because keylogging is reported. Reset them from a clean device and revoke associated sessions.
• Do not block WordPress sites indiscriminately. No validated campaign domains or IP addresses are available; enforce blocks only against internally confirmed destinations.

P2 — within 72 hours

• Rebuild confirmed Windows infections from trusted media. Component deletion alone is insufficient given the staged loaders, sandbox checks, propagation features and operator-directed collection.
• Hunt for PowerShell activity around reported fake-CAPTCHA encounters, followed by .NET loader execution and connections to WordPress-hosted infrastructure.
• Review WMI remote activity, SMB share access, network-share mapping, removable-media writes and propagation between hosts.
• Examine file-access and egress telemetry for drive enumeration, collection of selected documents, encrypted inventory data and repeated screenshot activity.
• Review WhatsApp web and desktop sessions on affected hosts and invalidate unexpected linked sessions.
• Upgrade WordPress core, plugins and themes to currently supported vendor releases; remove unsupported or unused plugins. No campaign-specific fixed version or implicated plugin is supplied.
• Compare affected WordPress files and database content against known-good copies. Review newly created administrators, credential changes and unexpected modifications.

P3 — within seven days

• Restrict PowerShell to approved administrative use through application control and centralised logging.
• Limit SMB and WMI administration across user segments and permit remote management only from authorised systems.
• Implement WordPress asset and plugin inventories, supported-version enforcement, multifactor authentication and file-integrity monitoring.
• Add ClickFix scenarios to security-awareness exercises: users must not execute commands copied from CAPTCHA or browser verification prompts.
• Test containment procedures for worm-capable malware involving network shares and removable media.

5. Indicators of compromise

No indicators of compromise available in the source material.

All behaviours below are single-sourced; verify before enforcement.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

7. Sources

• The Hacker News, “StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data,” https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html, 2026-08-19.

8. Adverse Trace position

Adverse Trace treats this as a material but currently unscored threat campaign: no CVE, verified CVSS score/severity or CISA KEV state is available. Confirmed exposure could produce credential and document loss, network-share propagation and optional encryption, but the prevalence of infection within EMEA financial services is unknown. “StopAndProtect” attribution remains unconfirmed because the actor has no MITRE ATT&CK profile, and the technical claims are single-sourced; verify before enforcement. Adverse Trace will monitor for primary research, independent corroboration and actionable indicators and will update this advisory if they become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.